Security overview

Summary

SEN Village is a closed, account-based community for adults (parents, guardians, and carers) supporting children with special educational needs. Security and safeguarding are built into the product from the start, not added later.

We use industry-standard practices that similar trusted apps rely on: secure sign-in, encryption in transit and at rest where appropriate, layered protection around our services, automated checks on public-facing content, and clear routes for members to report concerns.

This page explains what we do and why, in plain language. It does not describe our internal technology choices, configurations, or operational detail.

Our security principles

• Closed by default. Only registered, signed-in members reach community features.
• Least exposure. Sensitive system credentials never ship inside the mobile app.
• Defence in depth. Several independent layers protect the service, so no single control is the only line of defence.
• UK-first hosting. Core application and member data are hosted in the United Kingdom where practicable.
• Honesty. We explain what we protect, what we deliberately do not automatically review (for privacy), and how to raise concerns.

How the platform works

Members use the mobile app over encrypted connections (HTTPS). After creating an account and signing in, the app talks to our UK-hosted online services, which store community data in managed cloud databases.

Sign-up requires a valid email address and, for email registration, confirmation that you control that inbox before full access.

Those services sit behind layered protection from the public internet. Sensitive configuration stays on our servers, using the same kinds of controls you would expect from a modern cloud-hosted service.

Accounts and sign-in

• Secure registration. Adults (18+) create an account with email and password, or supported third-party sign-in where enabled.
• Email confirmation. For email sign-up, you must verify your email address before using the community.
• Session security. Signed-in sessions use industry-standard tokens (secure digital keys); access expires and can be revoked.
• Optional biometrics. You may use device Face ID or fingerprint to unlock an existing session. Biometric data never leaves your device.
• Account deletion. You can delete your account in-app; we handle data in line with our Privacy Policy.

Infrastructure and network

• Encryption in transit. All communication between the app and our services uses modern TLS (HTTPS).
• Edge protection. Industry-standard web firewalls (edge protection) sit in front of our live systems to block malicious traffic and abuse.
• Restricted backend access. Our live systems are not exposed directly to the open internet without those protections in place.
• Server-side trust. The app only receives what it needs to run; privileged access and cryptographic material stay on infrastructure designed for that purpose.
• Separated environments. Pre-release testing and live production use separate configurations.

Application and data

• Authenticated use. Profiles, notices, connections, and chat require a valid signed-in session.
• Encrypted private messages. Chat content is encrypted before it is stored in our database.
• Limited diagnostic exposure. Debug and internal test endpoints are not exposed on live production systems.

Community safety

These controls work alongside our Safety & safeguarding page.

• Automated review of public text. Written content in profiles and Noticeboard posts is checked automatically before it is published, using enterprise-grade content safety tooling tuned for a family community.
• Private chat. We do not automatically scan private chat messages for moderation. Those conversations are encrypted and treated as private between connected members. Reporting and safeguarding processes still apply.
• Reporting and blocking. You can report profiles, notices, and conversations, and block other members.
• Human follow-up. Serious or repeated concerns can be reviewed by our team under our community standards.

Payments

• App store billing. In-app purchases are handled by Apple or Google; we do not store card or bank details.
• Server-side receipt checks. Purchases are confirmed on our servers before credits are applied.

Data location and third parties

We use established cloud and specialist providers under terms appropriate to UK GDPR and the Data Protection Act 2018. Primary processing for the live service is in the United Kingdom.

Typical categories of provider include cloud hosting and databases, sign-in and authentication services, edge security and abuse protection, automated content safety (for public profile and notice text), push notifications (optional), app stores and in-app billing, and advertising (where shown in the free tier).

We do not sell personal data. International transfers, where they apply, are described in our Privacy Policy.

What we ask of members

• Use a strong, unique password and keep your device updated.
• Report content or behaviour that feels unsafe or inappropriate.
• Do not share your login details.
• Remember SEN Village is for adults (18+); only share child-related information you are legally entitled to share.

Security is ongoing. We continue to strengthen abuse protection, monitoring, and privacy-preserving safety measures as usage grows.

Report a concern

These addresses are monitored by our founding team. We use separate mailboxes so the right type of report is easy to spot.

• Safeguarding / community safety: in-app reporting, or support@sen-village.co.uk
• Privacy / data rights: support@sen-village.co.uk (see Privacy Policy)
• Security vulnerability disclosure: security@sen-village.co.uk — for technical security reports, kept separate from everyday support mail
• General enquiries: info@sen-village.co.uk

For urgent safeguarding involving immediate risk to a child, contact local emergency services or relevant UK authorities.